Acrolinx fixes

Author: DeCohen

CloudAppSecurityDocs/migrate-to-supported-api-solutions.md

@@ -5,11 +5,11 @@ ms.date: 05/19/2025
 ms.topic: article
 ---
 
-# Migrate from Defender for Cloud Apps SIEM Agent to Supported APIs
+# Migrate from Defender for Cloud Apps SIEM agent to supported APIs
 
-Transitioning from the legacy [Defender for Cloud Apps SIEM agent ](siem.md) to supported APIs enables continued access to enriched activities and alerts data. While the APIs may not have exact one-to-one mappings to the legacy Common Event Format (CEF) schema, they provide comprehensive and enhanced data enriched by integration across multiple Microsoft Defender workloads.
+Transitioning from the legacy [Defender for Cloud Apps SIEM agent ](siem.md) to supported APIs enables continued access to enriched activities and alerts data. While the APIs might not have exact one-to-one mappings to the legacy Common Event Format (CEF) schema, they provide comprehensive, enhanced data through integration across multiple Microsoft Defender workloads.
 
-## Recommended APIs for Migration
+## Recommended APIs for migration
 
 > To ensure continuity and access to data currently available through Microsoft Defender for Cloud Apps SIEM agents, we recommend transitioning to the following supported APIs:
 >
@@ -30,16 +30,16 @@ The table below compares the legacy SIEM agent’s CEF fields to the nearest equ
 | `rt`                                  | Activity or alert timestamp                                 | `createdDateTime`                                                                                | `createdDateTime` / `lastUpdateDateTime` / `resolvedDateTime`  |
 | `msg`                                 | Alert or activity description (human-readable)              | Closest structured fields: `actorDisplayName`, `ObjectName`, `ActionType`, `ActivityType`        | `description`                                                  |
 | `suser`                               | Activity or alert subject user                              | `AccountObjectId`, `AccountId`, `AccountDisplayName`                                             | See `userEvidence` resource type                               |
-| `destinationServiceName`              | Originating app (e.g., SharePoint, Box)                     | `CloudAppEvents > Application`                                                                   | See `cloudApplicationEvidence` resource type                   |
-| `cs<X>Label`, `cs<X>`                 | Dynamic fields (e.g., target user, object)                  | `Entities`, `Evidence`, `additionalData`, `ActivityObjects`                                      | Various `alertEvidence` resource types                         |
+| `destinationServiceName`              | Originating app (for example, SharePoint, Box)                     | `CloudAppEvents > Application`                                                                   | See `cloudApplicationEvidence` resource type                   |
+| `cs<X>Label`, `cs<X>`                 | Dynamic fields (for example, target user, object)                  | `Entities`, `Evidence`, `additionalData`, `ActivityObjects`                                      | Various `alertEvidence` resource types                         |
 | `EVENT_CATEGORY_*`                    | High-level activity category                                | `ActivityType` / `ActionType`                                                                    | `category`                                                     |
 | `<name>`                              | Matched policy name                                         | `Title`, `alertPolicyId`                                                                         | `Title`, `alertPolicyId`                                       |
 | `<ACTION>` (Activities)               | Specific activity type                                      | `ActionType`                                                                                     | N/A                                                            |
 | `externalId` (Activities)             | Event ID                                                    | `ReportId`                                                                                       | N/A                                                            |
 | `requestClientApplication` (activities)| User agent of client device                                | `UserAgent`                                                                                      | N/A                                                            |
 | `Dvc` (activities)                    | Client device IP                                            | `IPAddress`                                                                                      | N/A                                                            |
 | `externalId` (Alert)                  | Alert ID                                                    | `AlertId`                                                                                        | `id`                                                           |
-| `<alert type>`                        | Alert type (e.g., ALERT_CABINET_EVENT_MATCH_AUDI)           | -                                                                                                | -                                                              |
+| `<alert type>`                        | Alert type (for example, ALERT_CABINET_EVENT_MATCH_AUDI)           | -                                                                                                | -                                                              |
 | `Src` / `c6a1` (alerts)               | Source IP                                                   | `IPAddress`                                                                                      | `ipEvidence` resource type                                     |